ci: checkout base ref for backports

Checkout v7 still treats the pull_request_target default ref as fork PR code, so pin the backport checkout to the trusted base SHA.

.github/workflows/backport.yml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
+          ref: ${{ github.event.pull_request.base.sha }}
       - name: Create backport PRs
         id: backport
         uses: korthout/backport-action@v4